Exchange 2003 - Email content is stripped. Safe HTML?
Hi Everyone, I have a puzzling problem when the content of some emails is getting removed and I am trying to figure out by what service. Whats happening : Internal employee sends an email via Outlook 2007 -> Exchange 2003 Ent SP2-> Front-end Exchange 2003 Ent SP2 (with OWA) -> (hardware firewall) -> Other Company Server or gmail. Email is sent with a form (script) and its 160k in size, but arrives being 16k in size. So, content is getting stripped somewhere on the way and I believe it is Exchange server. Additional information : - Saving form and attaching it as .msg file same problem, content stripped - Saving form, archiving it and attaching .rar archive no problem, attachment isnt filtered - Sending email from gmail with a .msg comes in okay - Looking in the logs on both Exchange servers, I can see that 1st Exchange sends 160k message to front-end Exchange, but that one sends only 16k to gmail - Properties of front-end Exchange Default SMTP Virtual Server show that Filters arent enabled - Exchange servers run local antivirus (no 3d party filtering software), but I have it stopped for a period of troubleshooting no effect - Setting Outlook to Cached Exchange Mode and re-sending email no effect - Ive checked Application Log in Event Logs and tried turning on some diagnostic on front-end Exchange, but have not seen any messages that might relate to the problem. What I am trying to achieve : - See exactly where filtering is happening (email message bounce when filtered or log file entry) - Adjust the process that will allow forms to be sent out Which subsystem is it? Is it related to SafeHTML filtering? How do I enable logging and see where the filtering is happening? Cheers, Rod
August 27th, 2009 8:02am

Just adding some log info below from Back Office Exchange Server and Front End Exchange Server within the organization. There it can be see that BackOffice sends 121k of data to Front End, but then FrontEnd sends only 15k to Google. BackOfficeExchangeServer_20090826.log (sending mail to FrontEndExchangeServer(OWA) from BackOfficeExchangeServer) # Date Time client-ip Client-hostname Partner-Name Server-hostname server-IP Recipient-Address Event-ID MSGID Priority Recipient-Report-Status total-bytes Number-Recipients Origination-Time Encryption service-Version Linked-MSGID Message-Subject Sender-Address 2009-8-26 0:39:48 GMT - - - BackOfficeExchangeServer - SomeUser1@gmail.com 1027 84AE1493F4AE644CA2365D303B10EB890462365E@BackOfficeExchangeServer.internal.ADdomain.com 0 0 121604 1 2009-8-26 0:39:48 GMT 0 - c=US;a= ;p=ATS;l=BackOfficeExchangeServer-090826003948Z-7525 TestEmail EX:/O=ATS/OU=COS/CN=RECIPIENTS/CN=SomeUser1 - 2009-8-26 0:39:48 GMT - - - BackOfficeExchangeServer - SomeUser1@gmail.com 1019 84AE1493F4AE644CA2365D303B10EB890462365E@BackOfficeExchangeServer.internal.ADdomain.com 0 0 121604 1 2009-8-26 0:39:48 GMT 0 - - TestEmail - - 2009-8-26 0:39:48 GMT - - - BackOfficeExchangeServer - SomeUser1@gmail.com 1025 84AE1493F4AE644CA2365D303B10EB890462365E@BackOfficeExchangeServer.internal.ADdomain.com 0 0 121604 1 2009-8-26 0:39:48 GMT 0 - - TestEmail - - 2009-8-26 0:39:48 GMT - - - BackOfficeExchangeServer - SomeUser1@gmail.com 1024 84AE1493F4AE644CA2365D303B10EB890462365E@BackOfficeExchangeServer.internal.ADdomain.com 0 0 121604 1 2009-8-26 0:39:48 GMT 0 - - TestEmail - - 2009-8-26 0:39:48 GMT - - - BackOfficeExchangeServer - SomeUser1@gmail.com 1033 84AE1493F4AE644CA2365D303B10EB890462365E@BackOfficeExchangeServer.internal.ADdomain.com 0 0 121604 1 2009-8-26 0:39:48 GMT 0 - - TestEmail SomeUser1@some.company.com - 2009-8-26 0:39:48 GMT - - - BackOfficeExchangeServer - SomeUser1@gmail.com 1034 84AE1493F4AE644CA2365D303B10EB890462365E@BackOfficeExchangeServer.internal.ADdomain.com 0 0 121604 1 2009-8-26 0:39:48 GMT 0 - - TestEmail SomeUser1@some.company.com - 2009-8-26 0:39:48 GMT - - - BackOfficeExchangeServer - SomeUser1@gmail.com 1020 84AE1493F4AE644CA2365D303B10EB890462365E@BackOfficeExchangeServer.internal.ADdomain.com 0 0 121604 1 2009-8-26 0:39:48 GMT 0 - - TestEmail SomeUser1@some.company.com - 2009-8-26 0:39:48 GMT - - mail.some.company.com BackOfficeExchangeServer - SomeUser1@gmail.com 1031 84AE1493F4AE644CA2365D303B10EB890462365E@BackOfficeExchangeServer.internal.ADdomain.com 0 0 121604 1 2009-8-26 0:39:48 GMT 0 - - TestEmail SomeUser1@some.company.com - FrontEndExchangeServer_20090826.log (sending mail to Google) # Date Time client-ip Client-hostname Partner-Name Server-hostname server-IP Recipient-Address Event-ID MSGID Priority Recipient-Report-Status total-bytes Number-Recipients Origination-Time Encryption service-Version Linked-MSGID Message-Subject Sender-Address 2009-8-26 0:39:49 GMT IPofBackOfficeExchangeServer BackOfficeExchangeServer.internal.ADdomain.com - FrontEndExchangeServer IPofFrontEndExchangeServer SomeUser1@gmail.com 1019 84AE1493F4AE644CA2365D303B10EB890462365E@BackOfficeExchangeServer.internal.ADdomain.com 0 0 15478 1 2009-8-26 0:39:48 GMT 0 Version: 6.0.3790.3959 - TestEmail SomeUser1@some.company.com - 2009-8-26 0:39:49 GMT IPofBackOfficeExchangeServer BackOfficeExchangeServer.internal.ADdomain.com - FrontEndExchangeServer IPofFrontEndExchangeServer SomeUser1@gmail.com 1025 84AE1493F4AE644CA2365D303B10EB890462365E@BackOfficeExchangeServer.internal.ADdomain.com 0 0 15478 1 2009-8-26 0:39:48 GMT 0 Version: 6.0.3790.3959 - TestEmail SomeUser1@some.company.com - 2009-8-26 0:39:49 GMT IPofBackOfficeExchangeServer BackOfficeExchangeServer.internal.ADdomain.com - FrontEndExchangeServer IPofFrontEndExchangeServer SomeUser1@gmail.com 1024 84AE1493F4AE644CA2365D303B10EB890462365E@BackOfficeExchangeServer.internal.ADdomain.com 0 0 15478 1 2009-8-26 0:39:48 GMT 0 Version: 6.0.3790.3959 - TestEmail SomeUser1@some.company.com - 2009-8-26 0:39:49 GMT IPofBackOfficeExchangeServer BackOfficeExchangeServer.internal.ADdomain.com - FrontEndExchangeServer IPofFrontEndExchangeServer SomeUser1@gmail.com 1033 84AE1493F4AE644CA2365D303B10EB890462365E@BackOfficeExchangeServer.internal.ADdomain.com 0 0 15478 1 2009-8-26 0:39:48 GMT 0 Version: 6.0.3790.3959 - TestEmail SomeUser1@some.company.com - 2009-8-26 0:39:49 GMT IPofBackOfficeExchangeServer BackOfficeExchangeServer.internal.ADdomain.com - FrontEndExchangeServer IPofFrontEndExchangeServer SomeUser1@gmail.com 1034 84AE1493F4AE644CA2365D303B10EB890462365E@BackOfficeExchangeServer.internal.ADdomain.com 0 0 15478 1 2009-8-26 0:39:48 GMT 0 Version: 6.0.3790.3959 - TestEmail SomeUser1@some.company.com - 2009-8-26 0:39:50 GMT IPofBackOfficeExchangeServer BackOfficeExchangeServer.internal.ADdomain.com - FrontEndExchangeServer IPofFrontEndExchangeServer SomeUser1@gmail.com 1020 84AE1493F4AE644CA2365D303B10EB890462365E@BackOfficeExchangeServer.internal.ADdomain.com 0 0 15478 1 2009-8-26 0:39:48 GMT 0 Version: 6.0.3790.3959 - TestEmail SomeUser1@some.company.com - 2009-8-26 0:39:52 GMT IPofBackOfficeExchangeServer BackOfficeExchangeServer.internal.ADdomain.com mx.google.com FrontEndExchangeServer IPofFrontEndExchangeServer SomeUser1@gmail.com 1031 84AE1493F4AE644CA2365D303B10EB890462365E@BackOfficeExchangeServer.internal.ADdomain.com 0 0 15478 1 2009-8-26 0:39:48 GMT 0 Version: 6.0.3790.3959 - TestEmail SomeUser1@some.company.com -
Free Windows Admin Tool Kit Click here and download it now
August 28th, 2009 7:29am

Alright, how about a simple question then: How to trace if email was filtered by safe HTML on Exchange 2003?
August 31st, 2009 3:08am

Hi,To diagnose this issue, I suggest we install Archive Sink utility on Front-end server to capture message header for the message.You can use following knowledge base article to get more information about the functionality of Archive Sink and how to install it: http://support.microsoft.com/kb/871110Through that tool, we can get the message header in the stage of OnMessageSubmission and OnPostCategorize. Then confirm whether the message header was missing in localExchange ordestination server.Another method to narrow down the cause of the issue is send the email to external domain by using BE directly to replace FE server.ThanksAllen
Free Windows Admin Tool Kit Click here and download it now
August 31st, 2009 1:28pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics